CVE-2026-72882: Dokploy: Authenticated blind command injection via file mounts leads to direct remote host RCE on managed servers
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72882?
CVE-2026-72882 has a critical severity rating of 9.9.
How do I fix CVE-2026-72882?
To fix CVE-2026-72882, update Dokploy to version 0.28.9 or later.
What is the impact of CVE-2026-72882?
CVE-2026-72882 can lead to remote code execution on managed servers due to authenticated blind command injection.
Who is affected by CVE-2026-72882?
Any authenticated user with permission to create or update file mounts in Dokploy versions 0.28.8 and earlier is affected by CVE-2026-72882.
What software is involved in CVE-2026-72882?
CVE-2026-72882 involves the Dokdeploy Platform as a Service software.